Data Processing Agreements

For UK-based controllers processing under the UK General Data Protection Regulation and Data Protection Act 2018. Includes IDTA provisions for international transfers, breach notification under Article 33(2), controller warranties, and general authorisation of sub-processors with a right of objection.

For EEA-based controllers processing under Regulation (EU) 2016/679. Incorporates Standard Contractual Clauses (Module Two) for EU-US transfers.

For US businesses processing under California Consumer Privacy Act, CPRA, and applicable state privacy laws (VCDPA, CPA, CTDPA, UCPA).

SafeRedact, and the sub-processors that receive text extracted from documents (Anthropic and Amazon Web Services), are prohibited from using it to train, fine-tune, or improve AI models.

Anthropic and Amazon Web Services (AI classification, one per Processing Route), Vercel (hosting), Supabase (authentication and database), Stripe (payments), Resend (email to account users) and Slack (staff notifications). Roles, data and locations are published in the sub-processor schedule. 30 days’ notice before any change.

Notification without undue delay after SafeRedact becomes aware of a personal data breach, with the nature of the breach, the categories and approximate numbers concerned, and the measures taken, as far as then known.